hypothesis VS go-fuzz

Hypothesis for Property-Based Testing: Hypothesis is a Python library facilitating property-based testing. It offers a distinct advantage by generating a wide array of input data based on specified properties or invariants within the code. The perks of Hypothesis include:

But then add tests! Tests for LaTeX equations that had never been executable as code.

https://github.com/HypothesisWorks/hypothesis :

> Hypothesis is a family of testing libraries which let you write tests parametrized by a source of examples. A Hypothesis implementation then generates simple and comprehensible examples that make your tests fail. This simplifies writing your tests and makes them more powerful at the same time, by letting software automate the boring bits and do them to a higher standard than a human would, freeing you to focus on the higher level test logic.

> This sort of testing is often called "property-based testing", and the most widely known implementation of the concept is the Haskell library QuickCheck, but Hypothesis differs significantly from QuickCheck and is designed to fit idiomatically and easily into existing styles of testing that you are used to, with absolutely no familiarity with Haskell or functional programming needed.

pgregory.net/rapid is a modern Go property-based testing library initially inspired by the power and convenience of Python's Hypothesis.

Hypothesis to generate dummy data for test.

To create your own test cases, I recommend you use hypothesis-graphql in combination with hypothesis. hypothesis is a property-based testing library. Property-based testing is an approach to testing in which you make assertions about the result of a test given certain conditions and parameters. For example, if you have a mutation that requires a boolean parameter, you can assert that the client will receive an error if it sends a different type. hypothesis-graphql is a GraphQL testing library that knows how to use hypothesis strategies to generate query documents.

The Hypothesis stateful testing code is somewhat self-contained, since it mostly builds on top of internal APIs that already existed.

We've had a lot of success combining that approach with property-based testing (https://github.com/HypothesisWorks/hypothesis) for the query engine at backtrace: https://engineering.backtrace.io/2020-03-11-how-hard-is-it-t... .

Systems I've used for this include https://agda.readthedocs.io/en/v2.6.0.1/getting-started/what... https://coq.inria.fr https://www.idris-lang.org and https://isabelle.in.tum.de

An easier alternative is to try disproving the statement, by executing it on thousands of examples and seeing if any fail. That gives us less confidence than a full proof, but can still be better than traditional "there exists" tests. This is called property checking or property-based testing. Systems I've used for this include https://hypothesis.works https://hackage.haskell.org/package/QuickCheck https://scalacheck.org and https://jsverify.github.io

I used this method successfully for my qjson package . It accepts as input a human readable json. It detected a condition I forgot to check in a few minutes. I used the go fuzzer go-fuzz from Dmitry Vyukov. Check the impressive list of trophies at the end of the README. These are bugs found by the fuzzer.

It does instrumented fuzzing. The older https://github.com/dvyukov/go-fuzz would rewrite your sources to inject the instrumentation and pass the rewritten sources to the compiler, but it didn't really work with Go modules. This is something that probably makes sense to integrate with the compiler toolchain, same as `go test`'s coverage testing.

And another Go-Fuzz

Anyone seen good articles on converting go-fuzz tests to native fuzzing? Specifics on the new corpus format and a converter from go-fuzz would be really useful.

It’s great to hear that the fuzzer is built on go-fuzz so hopefully the conversion process won’t be too bad: https://github.com/dvyukov/go-fuzz/issues/329

> it shows the limitations of the language that you can't just build this inside the language.

Not sure why you'd make that assumption. https://github.com/dvyukov/go-fuzz

Rather than explore the specific issues my tests found, I started playing with running https://github.com/dvyukov/go-fuzz against go-json which seems to have fairly quickly found some issues. I've opened https://github.com/goccy/go-json/issues/174 to start the conversation about how you want to proceed here.

You can check the go-fuzz's trophies here.

Maybe you can add support for using a fuzzer like https://github.com/dvyukov/go-fuzz or https://github.com/google/gofuzz

I recently stumbled upon go-fuzz (that is also linked in the proposal). I'm amazed how fuzzing has made the go toolchain stronger and integrated this technique into some of our CI/CD pipelines for continuous testing. Having native fuzzy testing support (not just in go) would be great.

Go tests and benchmarks are so easy to write and run: just add TestFoo and BenchmarkFoo functions to a bar_test.go file, and "go test" does the rest. It's currently doable, but it requires a 3rd party library (go-fuzz) and a bit of fluffing around. This will make fuzz testing an equally first-class citizen with standard Go tooling (just add FuzzFoo), and as such we'll probably see a lot more people testing with fuzzing.

I used go-fuzz in GoAWK and it found several bugs (see https://benhoyt.com/writings/goawk/#fuzz-testing), and almost everyone who's done fuzz testing has similar reports. Certainly go-fuzz has found many, many bugs in Go itself: https://github.com/dvyukov/go-fuzz#trophies

For what it's worth, I wrote an article for LWN about the upcoming support for built-in fuzzing in Go: https://lwn.net/Articles/829242/ (of course, if you want full details, read the full proposal).